I can’t tell you how to parent, obviously, but kids and phones are a hairy subject

Neither iOS nor Android provide good APIs for real parental controls. They have MDM profiles that can do the job, but apps that use those for parental controls get removed or are tolerated out of their legacy presence. I wouldn’t trust anything but Google Family Link or a similar integrated parental control solution, to be honest. Kids are smart and they’ll find a way around restrictions eventually, but you can delay the inevitable as long as possible through something that kids can’t delete by hitting the right button sequence.

Open source apps intended to be privacy friendly alternatives all seem to come with the warning that you need to disable battery optimisations or the app will be killed by the OS, and that’s just not something you can prevent if the phone leaves your sight. If push comes to shove, anyone can boot a phone into Safe Mode (a mode in which Android only loads system applications and prevent user installed apps from opening) from which any app can be removed or disabled. This is done by holding down the right volume button(s) at the right time in the boot process (and happens accidentally).

Play Protect should guard against most malware. There are other antivirus apps but they’re often not free or privacy-preserving. Online scams can be prevented by using the browser’s native Safe Browsing feature (which either submits hashes or works offline depending on the configuration you choose for it).

Maybe it goes without saying, but if you’ve pulled software from open source websites or F-Droid, you’ll need to retract the permissions for the browser and/or unmanaged app stores to install new apps.

Unfortunately, you need to provide whatever safety system you use with some information or it won’t be able to do anything, and unless you want to be on call all day to hand out generated activation codes, you’ll probably want some kind of remote interface to deal with “kid needs to do homework but spent their internet time on silly videos” problems when they do inevitably show up.

Make sure your DNS blocking also works outside of WiFi. Your home solution may let through unexpected surprises when the phone switches back to the mobile carrier connection. NextDNS and such should work, a local pihole won’t.

Make sure that you need a full password and authentication flow if you’ve ever attached any kind of payment information to your kids’ or your parent accounts. Many kids are addicted to Roblox microtransactions and you never know what tricks the other kids at school may teach. You wouldn’t be the first parent to find a thousand dollars disappear into Roblox after a kid put their parent’s finger on the fingerprint scanner.

If your kid is allowed to download games, make sure they don’t download the virus-infected knock-offs. They’re not hard to recognise if you’re looking for them, but thousands of people fall for these things every year.

Make sure to set the appropriate age on your kids’ accounts. If they’re under 13, a lot of websites will take some additional privacy measures (or refuse service) because COPPA is no joke. I would also suggest assisting your kid for any app that needs an account to make sure they don’t lie about their age; apps may not work (as well) with kid accounts, but that’s for their own protection.

If they’re 13 or older, you’ll probably gain more through trust, understanding, and a healthy balance between privacy and safety than through stuffing phones full of monitoring apps. I’ve seen parents use controlling apps on 17 year old kids and I don’t believe for a second that those kids will ever come to their parents if they struggle with something because of the sheer lack of trust the constant monitoring displays.

Controversial as it may be, I wouldn’t recommend custom ROMs and all that stuff unless the phone is severely out of date. Most custom ROMs are made to give the user as much freedom and control as possible, and in this instance freedom should be somewhat restricted and control should be in your hands.

Having worked on the supply side of parental control stuff for a short while, I would advice to try to use punitive restrictions only as a last ditch effort. “No Youtube for a week” is not necessarily a bad punishment, but if you hand out such restrictions too arbitrarily, you’ll create more friction against the controls you put in place than when you make clear rules. That friction can be the spark for your kid getting the rebel hacker mindset, but I don’t think it’s worth it if that mindset develops as a means to fight you specifically.

Getting in the way of kids developing their autonomy with restrictions is how you get into “secret second phone stashed in a drawer” situations, which are unfortunately common enough that I know at least two people who have done that; they moved out for college and don’t seem to visit their parents all that often.